On Tue, Jun 1, 2010 at 6:55 AM, Heavy Man <span dir="ltr"><<a href="mailto:heavyman66@yahoo.com" target="_blank">heavyman66@yahoo.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
A few questions about DNSSEC...<br>
<br>
I understand the root zones are currently getting signed.</blockquote><div><br>The root zone is currently signed with a DURZ (deliberately unvalidatable root zone) as part of its deployment. See the following site for more information: <a href="http://www.root-dnssec.org/">http://www.root-dnssec.org/</a><br>
<br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Just for sanity sake, should I be able to DIG +dnssec <a href="http://a.gtld-servers.net" target="_blank">a.gtld-servers.net</a> and be able to see a RRSIG record (assume I have a valid dnssec recursive name server with a valid trust anchor configured).</blockquote>
<div><br>(As a side note, <a href="http://gtld-servers.net">gtld-servers.net</a> is the domain corresponding to the names of servers authoritative for TLD servers (e.g., edu, com, net), not the root zone.)<br><br>There is a difference between the name of a zone and the names of the servers authoritative for that zone, which are the "targets" of the NS records. For example:<br>
<br>$ dig . ns<br><br>; <<>> DiG 9.7.0-P1 <<>> . ns<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63188<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1<br>
<br>;; QUESTION SECTION:<br>;. IN NS<br><br>;; ANSWER SECTION:<br>. 484118 IN NS <a href="http://d.root-servers.net">d.root-servers.net</a>.<br>. 484118 IN NS <a href="http://l.root-servers.net">l.root-servers.net</a>.<br>
. 484118 IN NS <a href="http://i.root-servers.net">i.root-servers.net</a>.<br>. 484118 IN NS <a href="http://h.root-servers.net">h.root-servers.net</a>.<br>. 484118 IN NS <a href="http://e.root-servers.net">e.root-servers.net</a>.<br>
. 484118 IN NS <a href="http://j.root-servers.net">j.root-servers.net</a>.<br>. 484118 IN NS <a href="http://m.root-servers.net">m.root-servers.net</a>.<br>. 484118 IN NS <a href="http://g.root-servers.net">g.root-servers.net</a>.<br>
. 484118 IN NS <a href="http://a.root-servers.net">a.root-servers.net</a>.<br>. 484118 IN NS <a href="http://f.root-servers.net">f.root-servers.net</a>.<br>. 484118 IN NS <a href="http://c.root-servers.net">c.root-servers.net</a>.<br>
. 484118 IN NS <a href="http://k.root-servers.net">k.root-servers.net</a>.<br>. 484118 IN NS <a href="http://b.root-servers.net">b.root-servers.net</a>.<br><br>;; ADDITIONAL SECTION:<br>
<a href="http://a.root-servers.net">a.root-servers.net</a>. 144120 IN A 198.41.0.4<br><br>The zone origin is ".", but the names of the authoritative server are [a-m].<a href="http://root-servers.net">root-servers.net</a>. In DNSSEC, signing is done on a per-zone basis, so the signing of the <a href="http://root-servers.net">root-servers.net</a> zone is independent of (and unnecessary for) the signing of the root zone (".").<br>
<br>This being said, if you now query the root servers for DNSSEC RRs pertaining to the root zone, you will get the following:<br><br>$ dig @<a href="http://a.root-servers.net">a.root-servers.net</a> +dnssec . ns<br><br>; <<>> DiG 9.7.0-P1 <<>> @<a href="http://a.root-servers.net">a.root-servers.net</a> +dnssec . ns<br>
; (2 servers found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8463<br>;; flags: qr aa rd; QUERY: 1, ANSWER: 14, AUTHORITY: 0, ADDITIONAL: 21<br>;; WARNING: recursion requested but not available<br>
<br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags: do; udp: 4096<br>;; QUESTION SECTION:<br>;. IN NS<br><br>;; ANSWER SECTION:<br>. 518400 IN NS <a href="http://a.root-servers.net">a.root-servers.net</a>.<br>
. 518400 IN NS <a href="http://h.root-servers.net">h.root-servers.net</a>.<br>. 518400 IN NS <a href="http://j.root-servers.net">j.root-servers.net</a>.<br>. 518400 IN NS <a href="http://m.root-servers.net">m.root-servers.net</a>.<br>
. 518400 IN NS <a href="http://g.root-servers.net">g.root-servers.net</a>.<br>. 518400 IN NS <a href="http://e.root-servers.net">e.root-servers.net</a>.<br>. 518400 IN NS <a href="http://k.root-servers.net">k.root-servers.net</a>.<br>
. 518400 IN NS <a href="http://d.root-servers.net">d.root-servers.net</a>.<br>. 518400 IN NS <a href="http://c.root-servers.net">c.root-servers.net</a>.<br>. 518400 IN NS <a href="http://i.root-servers.net">i.root-servers.net</a>.<br>
. 518400 IN NS <a href="http://b.root-servers.net">b.root-servers.net</a>.<br>. 518400 IN NS <a href="http://l.root-servers.net">l.root-servers.net</a>.<br>. 518400 IN NS <a href="http://f.root-servers.net">f.root-servers.net</a>.<br>
. 518400 IN RRSIG NS 8 0 518400 20100607070000 20100531060000 55138 . xJyVQ+6RhZ7OQZFqFBY+z6xTeLWk7GpGljhp2zmkXVkK1bB3x0DZsdwA MF7+pyXa3hkUvbG4+MBErWmhiJveV/DyU00kZXrWc8oma82uhLvgBjwf /q7JArynxkbhrsbFoHT0IBQe9mQBhfJAta9myUEc01EGDVWwvpATMTTM Ktc=<br>
<br>which includes the RRSIG covering the NS RRset for the root zone.<br><br>Regards,<br>Casey<br>
</div></div>